Vulnerability Details : CVE-2020-1225
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1226.
Vulnerability category: Execute code
Exploit prediction scoring system (EPSS) score for CVE-2020-1225
Probability of exploitation activity in the next 30 days: 3.05%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 90 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2020-1225
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
[email protected] |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
[email protected] |
CWE ids for CVE-2020-1225
-
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Assigned by: [email protected] (Primary)
References for CVE-2020-1225
-
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1045
Third Party Advisory
-
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1225
Patch;Vendor Advisory
Products affected by CVE-2020-1225
- cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac_os:*:*
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:*
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:mac_os:*:*
- cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*
- cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*